Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data… (CVE-2026-91181)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret invite_id and email, and use it to join the team without authorization, via GET /api/v4/data_retention/policies/{policy_id}/teams.. Mattermost Advisory ID: MMSA-2026-00702
AI Analysis
Technical Summary
CVE-2026-91181 affects multiple Mattermost versions where the data retention teams API endpoint fails to sanitize Team objects properly. An authenticated user with read-only Data Retention Policy permission can retrieve sensitive information such as a private team's secret invite_id and email. This information can then be used to join the private team without proper authorization, violating access controls. The vulnerability is due to improper authorization checks and insufficient sanitization of returned data in the API response. It impacts Mattermost versions 11.9.0 and earlier in 11.9.x, 11.8.4 and earlier in 11.8.x, 11.7.7 and earlier in 11.7.x, and 10.11.22 and earlier in 10.11.x.
Potential Impact
An authenticated user with limited read-only Data Retention Policy permissions can escalate their access by obtaining secret invite identifiers and emails of private teams, allowing unauthorized joining of those teams. This leads to unauthorized access to private team resources and potentially sensitive information. The vulnerability compromises confidentiality and integrity but does not affect availability. The CVSS score of 6.5 reflects a medium severity impact with high confidentiality and integrity impact but no availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory (Mattermost Advisory ID: MMSA-2026-00702) for current remediation guidance. Until a patch or official fix is available, restrict permissions to the Data Retention Policy read-only role to trusted users only. Monitor vendor communications for updates on patches or temporary mitigations.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data… (CVE-2026-91181)
Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret invite_id and email, and use it to join the team without authorization, via GET /api/v4/data_retention/policies/{policy_id}/teams.. Mattermost Advisory ID: MMSA-2026-00702
CVSS v3.1
Score 6.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-91181 affects multiple Mattermost versions where the data retention teams API endpoint fails to sanitize Team objects properly. An authenticated user with read-only Data Retention Policy permission can retrieve sensitive information such as a private team's secret invite_id and email. This information can then be used to join the private team without proper authorization, violating access controls. The vulnerability is due to improper authorization checks and insufficient sanitization of returned data in the API response. It impacts Mattermost versions 11.9.0 and earlier in 11.9.x, 11.8.4 and earlier in 11.8.x, 11.7.7 and earlier in 11.7.x, and 10.11.22 and earlier in 10.11.x.
Potential Impact
An authenticated user with limited read-only Data Retention Policy permissions can escalate their access by obtaining secret invite identifiers and emails of private teams, allowing unauthorized joining of those teams. This leads to unauthorized access to private team resources and potentially sensitive information. The vulnerability compromises confidentiality and integrity but does not affect availability. The CVSS score of 6.5 reflects a medium severity impact with high confidentiality and integrity impact but no availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory (Mattermost Advisory ID: MMSA-2026-00702) for current remediation guidance. Until a patch or official fix is available, restrict permissions to the Data Retention Policy read-only role to trusted users only. Monitor vendor communications for updates on patches or temporary mitigations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-w86c-vmwh-pppx
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-91181"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6aa8a16055bf5e2cf5f3b6ee
Added to database: 09/15/2026, 01:37:36 UTC
Last enriched: 09/15/2026, 01:41:01 UTC
Last updated: 09/15/2026, 01:45:37 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.